wt/dnsmasq
1
0 Fork 0
mirror of http://thekelleys.org.uk/git/dnsmasq.git synced 2026-10-20 11:29:35 +00:00
Code Issues Packages Projects Releases Wiki Activity
1,881 Commits 1 Branch 397 Tags
9db275ebea5b5bb45bc06b4b6f042863b699bc58
Commit Graph
215 Commits
Author SHA1 Message Date
Petr Menšík 4ac517e4ac Fix coverity issues in dnssec.c 
Error: CHECKED_RETURN (CWE-252): [#def26]
dnsmasq-2.86rc3/src/dnssec.c:727: check_return: Calling "extract_name" without checking return value (as is done elsewhere 9 out of 10 times).
dnsmasq-2.86rc3/src/dnssec.c:459: example_checked: Example 1: "extract_name(header, plen, &p, keyname, 1, 0)" has its value checked in "extract_name(header, plen, &p, keyname, 1, 0)".
dnsmasq-2.86rc3/src/dnssec.c:269: example_checked: Example 2: "extract_name(header, plen, &state->ip, state->buff, 1, 0)" has its value checked in "extract_name(header, plen, &state->ip, state->buff, 1, 0)".
dnsmasq-2.86rc3/src/dnssec.c:569: example_checked: Example 3: "extract_name(header, plen, &p, keyname, 1, 0)" has its value checked in "extract_name(header, plen, &p, keyname, 1, 0)".
dnsmasq-2.86rc3/src/rfc1035.c:648: example_checked: Example 4: "extract_name(header, qlen, &p1, name, 1, 0)" has its value checked in "extract_name(header, qlen, &p1, name, 1, 0)".
dnsmasq-2.86rc3/src/rfc1035.c:787: example_checked: Example 5: "extract_name(header, qlen, &p1, name, 1, 0)" has its value checked in "extract_name(header, qlen, &p1, name, 1, 0)".
 #  725|         /* namebuff used for workspace above, restore to leave unchanged on exit */
 #  726|         p = (unsigned char*)(rrset[0]);
 #  727|->       extract_name(header, plen, &p, name, 1, 0);
 #  728|
 #  729|         if (key)

Error: CHECKED_RETURN (CWE-252): [#def27]
dnsmasq-2.86rc3/src/dnssec.c:1020: check_return: Calling "extract_name" without checking return value (as is done elsewhere 7 out of 8 times).
dnsmasq-2.86rc3/src/auth.c:140: example_checked: Example 1: "extract_name(header, qlen, &p, name, 1, 4)" has its value checked in "extract_name(header, qlen, &p, name, 1, 4)".
dnsmasq-2.86rc3/src/dnssec.c:771: example_checked: Example 2: "extract_name(header, plen, &p, name, 1, 4)" has its value checked in "extract_name(header, plen, &p, name, 1, 4)".
dnsmasq-2.86rc3/src/hash-questions.c:57: example_checked: Example 3: "extract_name(header, plen, &p, name, 1, 4)" has its value checked in "extract_name(header, plen, &p, name, 1, 4)".
dnsmasq-2.86rc3/src/rfc1035.c:1028: example_checked: Example 4: "extract_name(header, qlen, &p, name, 1, 4)" has its value checked in "extract_name(header, qlen, &p, name, 1, 4)".
dnsmasq-2.86rc3/src/rfc1035.c:1438: example_checked: Example 5: "extract_name(header, qlen, &p, name, 1, 4)" has its value checked in "extract_name(header, qlen, &p, name, 1, 4)".
 # 1018|
 # 1019|     p = (unsigned char *)(header+1);
 # 1020|->   extract_name(header, plen, &p, name, 1, 4);
 # 1021|     p += 4; /* qtype, qclass */
 # 1022|
 2021-09-11 22:08:25 +01:00
Dominik DL6ER e0ce3c12f2 Add all current RR types to the table of type names used for query logging. 
This patch also changes the method of calling querystr() such that
it is only called when logging is enabled, to eliminate any
possible performance problems from searching the larger table.
 2021-09-10 23:13:53 +01:00
Simon Kelley cac9ca38f6 Treat ANY queries the same as CNAME queries WRT to DNSSEC on CNAME targets. 2021-09-08 21:21:22 +01:00
Dominik DL6ER e7ccd95c04 Add EDE return when no matching key found. 2021-07-09 22:12:42 +01:00
Simon Kelley 6261aba026 Initial implementation of RFC-8914 extended DNS errors. 2021-06-26 00:38:01 +01:00
Simon Kelley 11c52d032b Initial changes for extended DNS error codes. 2021-06-21 17:37:46 +01:00
Simon Kelley 8ebdc364af Optimise sort_rrset for the case where the RR type no canonicalisation. 2021-01-22 18:50:43 +00:00
Simon Kelley 059aded070 Optimse RR digest calculation in DNSSEC. 
If an RR is of a type which doesn't need canonicalisation,
bypass the relatively slow canonicalisation code, and insert
it direct into the digest.
 2020-12-16 15:49:02 +00:00
Simon Kelley 2d765867c5 Use SHA-256 to provide security against DNS cache poisoning. 
Use the SHA-256 hash function to verify that DNS answers
received are for the questions originally asked. This replaces
the slightly insecure SHA-1 (when compiled with DNSSEC) or
the very insecure CRC32 (otherwise). Refer: CERT VU#434904.
 2020-12-16 15:49:02 +00:00
Simon Kelley 4e96a4be68 Fix remote buffer overflow CERT VU#434904 
The problem is in the sort_rrset() function and allows a remote
attacker to overwrite memory. Any dnsmasq instance with DNSSEC
enabled is vulnerable.
 2020-12-16 15:47:42 +00:00
Simon Kelley 532246fc9e Tweak to DNSSEC logging. 2020-04-04 18:50:56 +01:00
Kevin Darbyshire-Bryant c65b77c87f dnssec: add hostname info to insecure DS warning 
Make the existing "insecure DS received" warning more informative by
reporting the domain name reporting the issue.

This may help identify a problem with a specific domain or server
configuration.

Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
 2020-02-11 21:32:56 +00:00
Simon Kelley 2a8710ac2f Update copyrights to 2020. 2020-01-05 16:40:06 +00:00
Simon Kelley 19b0e3bf21 Check for REFUSED and SERVFAIL replies to DNSKEY queries. 2019-10-12 21:54:37 +01:00
Simon Kelley e24abf28a2 Fix botch in ae7a3b9d2e 
Loop variable must count up from zero, now we're using it as
an array index.
 2019-09-03 22:48:39 +01:00
Simon Kelley 69a0477b74 DNSSEC: unsigned RRs in the auth section are not bogus. 
Even if they are in a signed zone.
 2019-09-03 16:49:02 +01:00
Simon Kelley ae7a3b9d2e DNSSEC: implement RFC-4036 para 5.3.3. rules on TTL values. 2019-09-03 14:40:47 +01:00
Simon Kelley fef2f1c75e DNSSEC: Unsigned RRs in auth section proving that a DS doesn't exist are OK. 
In a reply proving that a DS doesn't exist, it doesn't matter if RRs
in the auth section _other_ than NSEC/NSEC3 are not signed. We can't
set the AD flag when returning the query, but it still proves
that the DS doesn't exist for internal use.

As one of the RRs which may not be signed is the SOA record, use the
TTL of the NSEC record to cache the negative result, not one
derived from the SOA.

Thanks to Tore Anderson for spotting and diagnosing the bug.
 2019-08-29 21:59:00 +01:00
Simon Kelley 05299fdd5a Fix wrong return code from explore_rrset() with some errors. 2019-07-15 22:04:20 +01:00
Simon Kelley cc921df9ce Remove nested struct/union in cache records and all_addr. 2019-01-02 22:48:59 +00:00
Simon Kelley ab194ed7ca Futher address union tidying. 
Pass DNSKEY and DS data into cache_insert via the address argument,
now these data types are included in struct all_addr.
 2019-01-01 01:35:30 +00:00
Simon Kelley 65a01b71bb Tidy address-union handling: move class into explicit argument. 
This moves the class argument to cache-insert into an argument,
rather then overloading a union in the address argument. Note that
tha class is NOT stored in the cache other than for DS/DNSKEY entries,
so must always be C_IN except for these. The data-extraction code
ensures this as it only attempts to cache C_IN class records.
 2018-12-31 23:56:33 +00:00
Simon Kelley 91421cb757 Fix compiler warning. 2018-10-18 19:21:55 +01:00
Simon Kelley e1791f36ea Fix logging of DNSSEC queries in TCP mode. Destination server address was misleading. 2018-10-06 23:23:23 +01:00
Simon Kelley f84e674d8a Be persistent with broken-upstream-DNSSEC warnings. 2018-05-04 16:29:57 +01:00
Simon Kelley 7f0084316a Handle DNSSEC-unaware upstream servers better. 2018-04-15 20:01:49 +01:00
Simon Kelley 4e72fec660 Fix DNSSEC without dnssec-check-unsigned. 
An oversight meant that non-existance checking was being done
anyway.

(Should probably alter the default for this.)
 2018-04-11 22:49:31 +01:00
Simon Kelley a969ba6e2a Special case NSEC processing for root DS record, to avoid spurious BOGUS. 2018-01-20 23:08:38 +00:00
Simon Kelley cd7df612b1 Fix DNSSEC validation errors introduced in 4fe6744a22 2018-01-20 00:10:55 +00:00
Simon Kelley 4fe6744a22 DNSSEC fix for wildcard NSEC records. CVE-2017-15107 applies. 
It's OK for NSEC records to be expanded from wildcards,
but in that case, the proof of non-existence is only valid
starting at the wildcard name, *.<domain> NOT the name expanded
from the wildcard. Without this check it's possible for an
attacker to craft an NSEC which wrongly proves non-existence
in a domain which includes a wildcard for NSEC.
 2018-01-19 12:39:46 +00:00
Ville Skyttä faaf306a63 Spelling fixes. 2018-01-14 17:32:52 +00:00
Simon Kelley e541245987 Handle duplicate RRs in DNSSEC validation. 
RFC 4034 says:
  [RFC2181] specifies that an RRset is not allowed to contain duplicate
  records (multiple RRs with the same owner name, class, type, and
  RDATA).  Therefore, if an implementation detects duplicate RRs when
  putting the RRset in canonical form, it MUST treat this as a protocol
  error.  If the implementation chooses to handle this protocol error
  in the spirit of the robustness principle (being liberal in what it
  accepts), it MUST remove all but one of the duplicate RR(s) for the
  purposes of calculating the canonical form of the RRset.

We chose to handle this robustly, having found at least one recursive
server in the wild which returns duplicate NSEC records in the AUTHORITY
section of an answer generated from a wildcard record. sort_rrset() is
therefore modified to delete duplicate RRs which are detected almost
for free during the bubble-sort process.

Thanks to Toralf Förster for helping to diagnose this problem.
 2018-01-06 22:16:31 +00:00
Simon Kelley d1ced3ae38 Update copyrights to 2018. 2018-01-01 22:18:03 +00:00
Simon Kelley 373e917389 Fix a6004d7f17 to cope with >256 RRs in answer section. 2017-12-01 22:40:56 +00:00
Simon Kelley b77efc1948 Tidy DNSSEC algorithm table use. 2017-10-27 23:23:53 +01:00
Simon Kelley ad9c6f06c5 Add support for Ed25519 DNSSEC signature algorithm. 2017-10-27 22:13:49 +01:00
Simon Kelley a6004d7f17 Fix caching logic for validated answers. 
The current logic is naive in the case that there is more than
one RRset in an answer (Typically, when a non-CNAME query is answered
by one or more CNAME RRs, and then then an answer RRset.)

If all the RRsets validate, then they are cached and marked as validated,
but if any RRset doesn't validate, then the AD flag is not set (good) and
ALL the RRsets are cached marked as not validated.

This breaks when, eg, the answer contains a validated CNAME, pointing
to a non-validated answer. A subsequent query for the CNAME without do
will get an answer with the AD flag wrongly reset, and worse, the same
query with do will get a cached answer without RRSIGS, rather than
being forwarded.

The code now records the validation of individual RRsets and that
is used to correctly set the "validated" bits in the cache entries.
 2017-10-25 17:48:19 +01:00
Simon Kelley 0549c73b7e Security fix, CVE-2017-14491 DNS heap buffer overflow. 
Fix heap overflow in DNS code. This is a potentially serious
security hole. It allows an attacker who can make DNS
requests to dnsmasq, and who controls the contents of
a domain, which is thereby queried, to overflow
(by 2 bytes) a heap buffer and either crash, or
even take control of, dnsmasq.
 2017-09-25 18:17:11 +01:00
Simon Kelley 50ca85504c Bump year in copyrights. 2017-06-24 22:43:18 +01:00
Vladislav Grishenko 4583dd9e42 Replace obsolete utime() usage with utimes(). 
This fixes build time warnings with POSIX.1-2008-aware c libraries.
 2017-05-03 23:16:51 +01:00
Josh Soref 730c6745f0 Comprehensive spelling/typo fixes. 
Thanks to Josh Soref for generating these fixes.
 2017-02-06 16:14:04 +00:00
Kevin Darbyshire-Bryant 06093a9a84 Fix problem with --dnssec-timestamp 
whereby receipt of SIGHUP would erroneously engage timestamp checking.
 2016-07-11 21:03:27 +01:00
Simon Kelley a7b27e84fa NULL pointer check. 2016-03-16 19:11:52 +00:00
Simon Kelley 40205a053e Bound hash-iterations in DNSSEC NSEC3 checking. 2016-03-14 21:24:00 +00:00
Simon Kelley 367341f745 Disable DNSSEC for server=/domain/.. servers unless trust-anchor provided. 2016-01-12 15:58:23 +00:00
Simon Kelley a63b8b89e6 DNSSEC: Handle non-root trust anchors, and check we have a root trust anchor. 2016-01-12 11:28:58 +00:00
Simon Kelley c49778df4a Update copyright notices. Happy new year! 2016-01-06 18:52:33 +00:00
Simon Kelley cc7cb0b893 Fix datatype-sixe botch which broke DNSSEC sig timestamps when far in the future. 2016-01-04 16:04:51 +00:00
Simon Kelley ec0628c4b2 Trivial code tweak. 2015-12-31 20:55:39 +00:00
Simon Kelley 33702ab1f8 First complete version of DNS-client-id EDNS0 and ARP tracking code. 2015-12-28 23:17:15 +00:00